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Response to Arguments 

Applicant's arguments filed on 11/14/06 have been fully considered but 
they are not persuasive. The previous 112 rejections are withdrawn. There are 
new ambiguities within the amended claims. 

Serbinis discloses sharing files and tokens throughout the reference as 
discussed below. 

Serbinis and Eldridge are both in the realm of tokens and sharing and 
having access to data via using tokens. 

Eldrige clearly point out the limitations on the use of the tokens both in the 
realm of number of use and the duration of use. It is inherent that once a token 
is used up, it is removed from the system such that the next user is not able to 
use the token again. Hence, Eldridge points out the limiting number of use of the 
tokens as far as accessing the information by the used of the tokens described 
below. 

2112 [R-3] Requirements of Rejection Based on Inherency; Burden of 

Proof 

The express, implicit, and inherent disclosures of a prior art reference may 
be relied upon in the rejection of claims under 35 U.S.C. 102 or 103. "The 
inherent teaching of a prior art reference, a question of fact, arises both in the 
context of anticipation and obviousness." In re Napier, 55 F.3d 610, 613, 34 
USPQ2d 1782, 1784 (Fed. Cir. 1995) (affirmed a 35 U.S.C. 103 rejection based 
in part on inherent disclosure in one of the references). See also In re Grasselli, , 
713 F.2d 731, 739, 218 USPQ 769, 775 (Fed. Cir. 1983). 
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Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 5, 16 and 27 rejected under 35 U.S.C. 112, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject 
matter which applicant regards as the invention. It is unclear how the applicant is 
removing a token value in a novel manner. That is, Eldrige and Serbinis clearly 
points out that these tokens can be used for a certain amount of time and/or for a 
certain number of times. Therefore, the removal of a token value is just removing 
a token and is well known in the art. The novelty and the way that there should 
be given weight to the removal of the token is unclear. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at.the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

Claims 5-9, 16-20 & 27-31 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Serbinis et al., U.S patent 6,314,425, and further in view of 
Eldridge et al., 2002/0095570. 

P = paragraph, i.e. p1 = paragraph 1. 
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As per claims 5, 16 & 27, Serbinis et al. discloses a 
method/system/computer readable medium of controlling access to data on a 
computer (abstract), the method comprising: 

Storing a list of valid token values (col. 21, 30-50; claim 1; abstract) 

accepting a request for a data item, wherein the request comprises a 
received token value that is only accepted for a specified (predetermined limit) 
(col.20, 16-25) number of requests (col.3, 57-67; col.4, 1-4; col.20, 16-25; The 
tokens are used to limit the user's access); 

determining that the received token value is within the list of valid token 
values (comparing tokens to a database of tokens that has saved the original 
tokens for this comparing part (col.21 , 30-50) (col.4, 66-67; col.5, 1-19; col.3, 57- 
67; col.4, 1-4; col.20, 16-25; Validating the token and limiting the amount of time 
the token can request to use the system/data.); and 

removing/deleting tokens from a list of tokens in a database (col.21 , 52-59); 

responding to the request by returning the data item in response to the 
determining that the received token value is valid (abstract; col.3, 57-67; col.4, 1-4; 
col.20, 16-25; Returning the data after the token has been validated and before 
the expiration time of the token, limiting the number of times the token can be used 
to request data from the system). 

Serbinis does not disclose limiting the usage of the token such that it has 
been accepted for fewer than the specified number of requests. Eldridge et al. 
discloses limiting the usage of the token such that it has been accepted for fewer 
than the specified number of requests (p8). The removal of the token is inherent in 
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Eldridge and as is shown above the removal of the token is explicitly carried out in 
Serbinis It would have been obvious to modify Serbinis to include limiting the 
usage of the token such that it has been accepted for fewer than the specified 
number of requests such as that taught by Eldridge et al. in order to avoid replay 
attacks (p8). 

As per claims 6, 17 & 28, Serbinis et al. further discloses charging (billing) 
an entity in response to retuning the data item the step in conjunction with the use 
of the token value (col. 15, 30-38). 

As per claims 7, 1 8 & 29, Serbinis et al. further discloses wherein the token 
value comprises an expiration time and wherein the determining further 
determines that the token value has not expired (col.21, 19-26). 

As per claims 9, 20 & 31 , Eldridge et al. and Serbinis et al. discloses 
wherein the list of stored and valid token values is shared with an entity that 
originated the data request (file sharing, and the token value (data) are in those 
files) (Eldridge et al.: p29, 31, 37 and 80-82) (Serbinis et al: abstract; col.2, 43- 
49). 

As per claims 35 and 36, Serbinis further discloses periodically generating, 
with a period, a respective new list of valid token values (abstract; col. 21 , 30-50; 
claim 1); sending, in response to the periodically generating, the new list of stored 
and valid token values to the associated computer (abstract; col. 21 , 30-50; claim 
1 ), wherein a respective expiration time of each token value in the new list 
of valid token values is based upon the period so as to cause generation of the 
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respective new list of valid token values prior to expiration of previously generated 
valid token values (abstract; col. 21, 30-50; claim 1; col.20, 16-25). 

As per claims 37, Serbinis further discloses wherein the token value has 
been signed by the associated computer, and wherein the determining that the 
token value is valid and has been accepted for fewer than the specified number of 
requests comprises verifying the signed token value (abstract; col. 21, 30-50; claim 
1; col.20, 16-25). 

Claim 34 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Serbinis et al., U.S patent 6,314,425 as applied to claim 5 above, and further in 
view of Khater, U.S. patent application publication 2002/0184143 or Pisarsky 
2002/0147838. 

As per claim 34, Serbinis et al. discloses a method/system/computer 
readable medium of controlling access to data on a computer as discussed above. 
Serbinis et al. does not disclose wherein the token value is only accepted one 
time, and wherein the responding to the request is performed in response to the 
token value having not been previously accepted (code/password can only be 
used once; request is only accepted one time). Khater or Pisarsky disclose 
wherein the token value is only accepted one time, and wherein the responding to 
the request is performed in response to the token value having not been previously 
accepted (code/password can only be used once; request is only accepted one 
time) (Khater, p16) (Pisarsky, p5). It would have been obvious to modify Serbinis 
et al. to include wherein the token value is only accepted one time, and wherein 
the responding to the request is performed in response to the token value having 
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not been previously accepted (code/password can only be used once; request is 
only accepted one time) such as that taught by Khater or Pisarsky in order to reject 
any double usage of the code hence improving the security of the system since a 
after the code is used a new code has to be generated for the next request to go 
through the system. 

Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will 
the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Corbin (U.S. patent 5,138,712) discloses an apparatus and method for 
licensing software on a network of computers. 

Norris (U.S. patent 6,718,328) discloses a system and method for 
providing controlled and secured access to network resources. 
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Lau et al. (U.S. patent 6,182,124) discloses a token-based deadline 
enforcement system for electronic document submission. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Behrang Badii whose telephone number is 
571-272-6879, The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, James Trammell can be reached on 571-272-6712. The 
fax phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 

Any response to this action should be mailed to: 

Mail Stop Amendment 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

or faxed to (571)273-8300 

Hand delivered responses should be brought to 
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United States Patent and Trademark Office 
Customer Service Window 
Randolph Building 
401 Dulany Street 
Alexandria, VA 22314 



Any inquiry of a general nature or relating to the status of this 



application or proceeding should be directed to the Technology Center 3600 
Customer Service Office whose telephone number is (571) 272-3600. 
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